adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-06 11:12:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #35 from Sea-Haven-Industries/codex/sh133-s3-read-fix
Some checks are pending
Validate and deploy dev / Validate deployable source bundle (push) Waiting to run
Details
Validate and deploy dev / Deploy shoc-backend to Elastic Beanstalk dev (push) Blocked by required conditions
Details

Browse source 
Fix Elastic Beanstalk bundle validation
This commit is contained in:
Alexandre Brandizzi 2026-07-28 11:19:57 -03:00 • committed by GitHub
commit 8f41190a74
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
infra/cdk/README.md
View file

@ -41,8 +41,10 @@ The role grants only:
- `elasticbeanstalk:CreateApplicationVersion` on application `shoc-backend`. - `elasticbeanstalk:CreateApplicationVersion` on application `shoc-backend`.
- `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only. - `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only.
- `s3:ListBucket` on `elasticbeanstalk-us-east-1-396287094661` (the official - `s3:ListBucket` on `elasticbeanstalk-us-east-1-396287094661` (the official
action's ownership-safe `HeadBucket` check) and `s3:PutObject` only under the action's ownership-safe `HeadBucket` check). Under the `shoc-backend/` object
`shoc-backend/` object prefix. prefix only: `s3:PutObject` plus `s3:GetObject` and `s3:GetObjectVersion`,
which the pinned official deployment action requires to validate the
`CreateApplicationVersion` source bundle after upload.
It grants **no** IAM mutation or `PassRole`, **no** RDS / EC2 / Secrets Manager It grants **no** IAM mutation or `PassRole`, **no** RDS / EC2 / Secrets Manager
access, and **no** administrator policy. There are no wildcard mutation access, and **no** administrator policy. There are no wildcard mutation

2
infra/cdk/deploy-dev-stack.ts
View file

@ -81,7 +81,7 @@ export class DeployDevStack extends cdk.Stack {
deployRole.addToPolicy( deployRole.addToPolicy(
new iam.PolicyStatement({ new iam.PolicyStatement({
effect: iam.Effect.ALLOW, effect: iam.Effect.ALLOW,
actions: ['s3:PutObject'], actions: ['s3:GetObject', 's3:GetObjectVersion', 's3:PutObject'],
resources: [`${bucketArn}/${APPLICATION_NAME}/*`], resources: [`${bucketArn}/${APPLICATION_NAME}/*`],
}), }),
); );